Need security advice...

wantviews · Dec 14, 2022

Hope everyone is safe and sound !
So i recently started developing websites and even though i'm mostly able to do my elementor/ssl/wordpress work myself there is a always something that's not working and i spent hours and hours of searching for answers on YT Stackoverflow etc etc. But suddenly I had a bright idea of hiring Worpress errors fixers on Fiverr for $5/$10 dollars. This exact thing saved my ass today in a very profound way, so i plan to do that in the future when I have aboslutely no idea what to do.. but I see the security issue.

You give temporary admin rigths to somebody.. a lot of things can possibly go wrong if ill will is involved.. so since i'm not well-versed in these matters and only a few weeks into learning to code and understanding the whole wordpress infrastructure, can you tell me what can they do? And how can it be prevented?

Obviously prior to that i did some research as well and found plug-ins that create user activity logs, there are free ones and paid ones. But the question is: couldn't they just disable the plug-in while they hacking my stuff?

I would really appreciate an adivce on this one guys!

zionbar · Dec 14, 2022

Thats a good question, in my experience the IT guys dont really mess with u they just want to get paid but u do bring up a good point especially if u have data thats valuable

wantviews · Dec 14, 2022

zionbar said:
Thats a good question, in my experience the IT guys dont really mess with u they just want to get paid but u do bring up a good point especially if u have data thats valuable

Afaik mostly, like 90% of the times they care about good reviews so they don't mess things up but there was a case once that someone changed the paypal information on some E-commerce website, which is fairly obvious to keep track of , but since i'm amateur I think that something more low-key could be done. also they can mess with databases and personal info. And you can track that but not really prevent it. But tracking it would still be a very good security measure on its own.

uncutu · Dec 14, 2022

WP has user roles and unfortunately administrator is only role that allows for adjusting themes, plugins, scripts.

to combat ill-will try to build relationship with a "wp-fixer" maybe get them on a weekly payroll.

from security aspect, you can install a plugin like "admin audit" so you can get a report of every change your freelancer did. ideally you are making them their own temporary admin account so the audit log will reflect their user making changes rather than your main admin acct.

ofcourse if they are maliscious they may have capacity to tamper the log....so make sure the audit plugin you find cannot be tampered with.

other than that, run your own audit -- make sure they did not add a hidden administrator account for themselves, adjust the p/w reset email, or add any plugins you did not authorize. hopefulyl a good audit plugin will automate 99% of that for you.

if you're really paranoid ask your worker to do the whole thing over screenshare.

without access to your ftp/cpanel theres not too much they can do other than install malicious plugins, attempt to hijack, redirect your site. all easily cured. you mentioned doing e-com so they have potential to dump your customer data and do whatever they want there.

wantviews · Dec 14, 2022

uncutu said:
WP has user roles and unfortunately administrator is only role that allows for adjusting themes, plugins, scripts.

to combat ill-will try to build relationship with a "wp-fixer" maybe get them on a weekly payroll.

from security aspect, you can install a plugin like "admin audit" so you can get a report of every change your freelancer did. ideally you are making them their own temporary admin account so the audit log will reflect their user making changes rather than your main admin acct.

ofcourse if they are maliscious they may have capacity to tamper the log....so make sure the audit plugin you find cannot be tampered with.

other than that, run your own audit -- make sure they did not add a hidden administrator account for themselves, adjust the p/w reset email, or add any plugins you did not authorize. hopefulyl a good audit plugin will automate 99% of that for you.

if you're really paranoid ask your worker to do the whole thing over screenshare.

without access to your ftp/cpanel theres not too much they can do other than install malicious plugins, attempt to hijack, redirect your site. all easily cured. you mentioned doing e-com so they have potential to dump your customer data and do whatever they want there.

I appreciate you immensely! Very valuable for me and hopefully for others too.

itz_styx · Dec 14, 2022

if you give someoen access to your wp, trust is the only way. find someone you can trust not to do something shady.
otherwise no plugin is good enough to reveal what someone did as it can be just edited out of the logs.
you would need server side logging from a process that has different permissions than your wp install, so in case someone who only has access to wp, can't access the logfiles.
most secure is remote logging to a different server, which makes it even harder to modify the logs.

uncutu said:
without access to your ftp/cpanel theres not too much they can do other than install malicious plugins, attempt to hijack, redirect your site. all easily cured. you mentioned doing e-com so they have potential to dump your customer data and do whatever they want there.

you can easily get shell access with a PHP backdoor which is essentially like ftp access, but even better as you can execute OS commands. from there someone might also get into cpanel.

backbonee4all · Jan 1, 2023

Follow the way You can Protect your WordPress websites.
=============================================

1.Make sure always core file themes and plugins latest version update

2.avoid nulled themes

3.Give access or deny to WordPress Login page only from specific IP

4.Control Access to login page via Country

5.Disable XML-RPC

6.Disable PHP Error Reporting

7.Disable File Editor

8.Protect wp-config file

9.change the File Permission write protected

10.Hide WordPress default login page by changing the login URL

11.Hide your WordPress from bad bots, attackers and also theme detector sites

12.hide comments

13.protect your database changing the default table (wp_) prefix

Need security advice...

wantviews

Junior Member

zionbar

Elite Member

wantviews

Junior Member

uncutu

Elite Member

wantviews

Junior Member

itz_styx

Elite Member

backbonee4all

Registered Member

Main Menu

Marketplace

Making Money

BlackHat World